CYFOR Blog

CYFOR was contacted by a solicitor regarding the resignation of an employee and subsequent employment with a competitor, leading to a contentious situation.

Due to the employer’s suspicions, all company-owned devices were removed from his possession and secured upon the employee’s exit from the business. After an initial internal review, it transpired that recent excel documents containing huge quantities of CRM data files had been downloaded.

Upon receiving instruction from the client’s solicitor, the investigation ensued and CYFOR were provided with focus keywords. These included names and email addresses, with the aim of determining if prior to leaving the business, he siphoned off any valuable intellectual property to the competition. There was also a line of enquiry followed to identify any potential correspondence that implicated the rival business persuading the theft of data that would aid in their operations.

The primary tools used during this investigation were:

• CAINE version 9.0.
• EnCase version 8.05.00.182.
• Internet Evidence Finder (IEF), version 6.12.3.9083.
• Nuix version 7.2.4.

Processing & Imaging

To determine whether or not an in-depth investigation was possible, CYFOR provided an initial analysis of the laptop without processing a fee. We were then able to provide an accurate quotation and determine how long it would take to complete, with an accompanying report. CYFOR was instructed to conduct an analysis of the supplied digital evidence and review and identify the following in accordance with the principles and guidelines detailed in the Association of Chief Police Officers guidelines;

• USB storage devices
• Files created and copied to the USB storage devices.
• Deleted recoverable Excel or Word files.
• Documents created or accessed on specific dates.
• Email correspondence with specific individuals.
• Online storage artefacts.

If you would like to find out more about our data theft case study or our extensive capabilities, then please feel free to get in touch